CVE-2019-11674

Man-in-the-middle vulnerability in Micro Focus Self Service Password Reset, affecting all versions prior to 4.4.0.4. The vulnerability could exploit invalid certificate validation and may result in a man-in-the-middle attack...

CVE-2019-11674

CVE-2019-11674 affects Micro Focus Self Service Password Reset prior to version 4.4.0.4. The issue is a certificate validation flaw enabling potential man-in-the-middle attacks. The description across connected records confirms the root cause as invalid certificate validation and implies exploita...

Cloud Research Network Technology Co., Ltd. website building system has a logic flaw vulnerability

Cloud Research Network Technology Co., Ltd. is a company dedicated to optimizing employment methods with Internet thinking and guiding employment services with a big data platform. There is a logic flaw vulnerability in the website building system of Cloud Research Network Technology Co., Ltd,...

Smart Battery License Issue Vulnerability

Smart Battery A4 is a portable power supply device. An authorization issue vulnerability exists in the Smart Battery A4 using firmware version r1.7.9 and earlier. An attacker can exploit this vulnerability to obtain/reset the administrator password without authentication...

SilverStripe License Issues Vulnerabilities

SilverStripe is New Zealand SilverStripe company's set of open source programming framework and content management system CMS. The system has support for multiple languages , cross-platform and other features . An authorization issue vulnerability exists in SilverStripe 4.3.3 and earlier versions...

pixiv: Reset any password

Summary: When I try to reset the password, the verification code of the mailbox is 6 digits, and there is no limit on the number of submissions, so I can reset the password of any user. Steps To Reproduce: 1.input the email reset password url. F595146 click the "submit" button F595147 input the...

Unspecified Vulnerability in Teclib GLPI

Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A security vulnerability exists in Teclib GLPI 9.4.3 and earlier versions,...

Cryptographically Weak PRNG

Overview Versions of generator-jhipster use a Cryptographically Weak PRNG that may lead to account takeover. The package uses a cryptographically insecure method to generate password reset links, which allows an attacker to guess password reset links and takeover accounts. Recommendation Update t...

CVE-2019-14666

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any use...

CVE-2019-14666

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any use...

UBUNTU-CVE-2019-14666

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any use...

CVE-2019-14666

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any use...

CVE-2019-14666

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any use...

New Relic: Host Header Injection

Reproduction 1- open reset link https://login.newrelic.com/passwords/forgot 2- Enter the victim's email address and click Reset and Email Password 3- Intercept the HTTP request in Burp Suite & add X-Forwarded Host Header and write attacker.com/.newrelic.com link will be like...

PT-2019-6427 · Ruijie · Ruijie Eg-2000 Series Gateway

Name of the Vulnerable Software and Affected Versions: Ruijie EG-2000 series gateway versions 11.11B1 Description: The issue affects the Ruijie EG-2000 series gateway, where an attacker can easily dump cleartext stored passwords in /data/config.text using simple XORs. This allows a remote attacke...

PHPWind se***.php file has a password reset vulnerability

PHPWind is a PHP-based Web forum program. A password reset vulnerability exists in the PHPWind se.php file. An attacker can exploit the vulnerability to reset any password...

PT-2019-14615 · Jhipster +1 · Jhipster Kotlin +2

Name of the Vulnerable Software and Affected Versions: JHipster versions prior to 6.3.0 JHipster Kotlin versions prior to 1.2.0 Description: A vulnerability exists due to the use of an insecure source of randomness, specifically apache.commons.lang3 RandomStringUtils, which allows an attacker to...

CVE-2019-12943

TTLock devices do not properly restrict password-reset attempts, leading to incorrect access control and disclosure of sensitive information about valid account names...

Design/Logic Flaw

TTLock devices do not properly restrict password-reset attempts, leading to incorrect access control and disclosure of sensitive information about valid account names...

CVE-2019-12943

The CVE-2019-12943 entry concerns TTLock devices where password-reset attempts are not properly restricted, causing incorrect access control and disclosure of valid account names. Affected product: TTLock devices. Root cause: insufficient restrictions on password-reset flow. Impact: potential acc...